Skip to content

[LG-7191] Suppress content security policy #6705

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
gangelo wants to merge 2 commits into from
Closed

[LG-7191] Suppress content security policy #6705

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
33e952a
Suppress content security policy
gangelo Aug 8, 2022
8deccd4
return typically behaves poorly
gangelo Aug 9, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions app/controllers/concerns/idv/document_capture_concern.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ module Idv
module DocumentCaptureConcern
def override_document_capture_step_csp
return if params[:step] != 'document_capture'
return if IdentityConfig.store.suppress_content_security_policy
Copy link
Copy Markdown
Contributor

@zachmargolis zachmargolis Aug 8, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this methods opens up the policy, does it still cause problems for the accessibiltiy tool on this step if we leave it in?

Copy link
Copy Markdown
Contributor Author

@gangelo gangelo Aug 9, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure about that, I have to test that out.


policy = current_content_security_policy
policy.script_src(*policy.script_src, :unsafe_eval)
Expand Down
2 changes: 2 additions & 0 deletions app/controllers/concerns/secure_headers_concern.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,8 @@ def apply_secure_headers_override
end

def override_form_action_csp(uris)
return if IdentityConfig.store.suppress_content_security_policy

policy = current_content_security_policy
policy.form_action(*uris)
request.content_security_policy = policy
Expand Down
2 changes: 2 additions & 0 deletions app/helpers/secure_headers_helper.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,8 @@ def add_document_capture_image_urls_to_csp_with_secure_headers(request, urls)
end

def add_document_capture_image_urls_to_csp_with_rails_csp_tooling(request, urls)
return if IdentityConfig.store.suppress_content_security_policy

policy = request.content_security_policy.clone
policy.connect_src(*policy.connect_src, *urls)
request.content_security_policy = policy
Expand Down
1 change: 1 addition & 0 deletions config/application.yml.default
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -284,6 +284,7 @@ voip_check: true
voip_block: true
voip_allowed_phones: '[]'
inherited_proofing_va_base_url: 'https://staging-api.va.gov'
suppress_content_security_policy: false

development:
aamva_private_key: 123abc
Expand Down
3 changes: 3 additions & 0 deletions config/initializers/content_security_policy.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@

# rubocop:disable Metrics/BlockLength
Rails.application.config.content_security_policy do |policy|
next if IdentityConfig.store.suppress_content_security_policy

connect_src = ["'self'", '*.nr-data.net', '*.google-analytics.com', 'us.acas.acuant.net']

font_src = [:self, :data, IdentityConfig.store.asset_host.presence].compact
Expand Down Expand Up @@ -59,6 +61,7 @@
policy.base_uri :self
end
# rubocop:enable Metrics/BlockLength

Rails.application.configure do
config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
config.content_security_policy_nonce_directives = ['script-src']
Expand Down
1 change: 1 addition & 0 deletions lib/identity_config.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -376,6 +376,7 @@ def self.build_store(config_map)
config.add(:voip_block, type: :boolean)
config.add(:voip_check, type: :boolean)
config.add(:inherited_proofing_va_base_url, type: :string)
config.add(:suppress_content_security_policy, type: :boolean)

@store = RedactedStruct.new('IdentityConfig', *config.written_env.keys, keyword_init: true).
new(**config.written_env)
Expand Down